Loading vulnerability…
Compressed JWE Resource Exhaustion in go-jose
CVE-2024-28180 is a data-amplification vulnerability in the go-jose implementation of JSON Object Signing and Encryption standards. The Decrypt and DecryptMulti functions inadequately limit decompression of compressed JSON Web Encryption (JWE) payloads, allowing attacker-controlled data to consume excessive memory and CPU. Processing a specially crafted JWE can cause denial of service. Fixed versions reject payloads whose decompressed size exceeds the larger of 250 kB or ten times the compressed size.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can degrade application performance, exhaust CPU and memory resources, or crash the affected process, resulting in denial of service. No direct confidentiality or integrity impact is identified. Red Hat rates the vulnerability Moderate, with CVSS v3.1 score 4.3 and vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
If you can’t patch tonight, do this now.
Where feasible, reject compressed JWE payloads before they reach the vulnerable decompression code. Restrict access to affected processing interfaces and apply CPU and memory limits, request limits, and timeouts as defense-in-depth measures. Compressed-input size limits alone do not reliably prevent decompression amplification. Red Hat identifies no generally applicable mitigation meeting its product-security criteria; upgrading remains the preferred remedy.
Patch, then assume compromise.
Upgrade go-jose to version 4.0.1 or later in the v4 branch, 3.0.3 or later in the v3 branch, or 2.6.3 or later in the v2 branch. Rebuild and redeploy applications and container images that bundle the vulnerable dependency, or install the applicable vendor-patched packages and images. The archived gopkg.in/square/go-jose.v2 package will not receive a fix; migrate to a maintained, patched package.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
51 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.